topic Re: Encrypted storage with TrustZone in i.MX Processors

Encrypted storage with TrustZone

brucezhao — Mon, 22 Aug 2022 08:40:41 GMT

Hi,

AN12714 (i.MX Encrypted Storage Using CAAM Secure Keys) document describes Encrypted storage with CAAM.

My question is that if I want to use CSU(Central Security Unit) to limit only OP-TEE can access CAAM, then CAAM can not be accessed by Normal world directly. I mean how to implement encrypted storage with OP-TEE, which uses OTPMK as root key by CAAM.

Thanks.

Re: Encrypted storage with TrustZone

Harvey021 — Thu, 25 Aug 2022 10:03:56 GMT

Hi @brucezhao

OP-TEE itself is secure world, which should be able to access CAAM. AN12714 here mainly uses the kernel module DM-Crypt, which uses CAAM's secure key to implement disk encryption, and does not implement the requirements you mentioned.

Best regards

Harvey

Re: Encrypted storage with TrustZone

brucezhao — Tue, 30 Aug 2022 07:58:43 GMT

Hi Harvey, I got it. Thank you for your reply.